Key Fob Range Hack? - Where are the EE/RF Gurus!

Started digging in to see if there might be a hack for increasing the range on the keyless entry. This Land Cruiser antenna extension peaked my interest https://forum.ih8mud.com/threads/mod-extending-range-of-keyless-entry.1113795/ and I was exploring the FCC report for the Gen 3's to see if there was anything similar but the antenna looks a bit different.

https://fcc.report/FCC-ID/HYQ23ABN

I see they use the same sensor to read TPMS and RKES: Remote Keyless Entry System

Type of receiving system :

Super-heterodyne​

Frequency of Operation :

RKES (CH1): 314.35 MHz
RKES (CH2): 312.10 MHz
TPMS: 314.98 MHz​

Oscillator Frequency:

30.265 MHz Crystal​

Type of Modulation :

RKES: FSK (F1D)
TPMS: FSK (F1D)​

Power Supply:

DC 12.0 V ​

Antenna Type :

Internal antenna (Inverse F antenna / Inverse L antenna)​

Voltage Controlled Oscillator :

RKES (CH1): 1884.42 MHz
RKES (CH2): 1870.94 MHz
TPMS: 1888.20 MHz * ​

Anyone crafty enough to make sense of this without doing more harm than good? Other than the 'ole place the key fob to your head trick anyone figure out a reasonable way to increase range yet?

 

The transponder sends out constant signal and looks like a mod would drain battery quicker as i am good with the range and a new battery I use a faraday case so it dosen't transmit everywhere like an elt on an airplane . Just my 2 cents for what its worth.

 

When a FOB for every car I’ve owned with one (10+) ‘23 Tundra included, doesn’t respond at a long distance I just hold it under my chin and it then works every time (brain antenna)

 

Probably the easiest way to increase transmit power / range would be to increase supply voltage. The FOB runs of a 3V lithium battery. The electronics should be able to handle 5V supply voltage like most digital ICs. The transmitter power transistor (either part of an IC or a discrete element) is essentially a constant current device so increasing the voltage should increase transmit power proportionally. The risk is, of course, frying some electronics due to higher than design voltage (and/or current as I = V / R). If you are willing to risk the cost of an FOB, it's easy to try.
Another option is to build a 1/2-wavelength dipole antenna. At 312 Mhz it would be approx. 1.5 ft in total length, with two "legs" of 0.75 ft (9 in) each. You can shorten the legs with inductive "loading", but the math gets more complicated, and there will be some gain loss vs. a "pure" dipole. It will be directional, with most power radiated perpendicularly to the antenna. It would have approx. 2 dB gain over an isotropic antenna. The tiny loop antenna in the FOB is probably less efficient than an isotropic, so the actual gain will be higher. The next step would be to take the dipole one step further and build a Yagi. Depending on number of elements, you will get more gain, but also more directionality.
https://en.wikipedia.org/wiki/Dipole_antenna
https://en.wikipedia.org/wiki/Yagi–Uda_antenna
(I'm a radio amateur extra, hardly an expert but more than average knowledge.)

 

You already did all of the background work, now try it.

All the other post did was solder in an extension coax and put a 315MHz antenna in a better location. I'd try tying into the lower left of the module which has all of the discretes, and if need be, add jumpers to the other OEM antenna locations incase the TPMS board section is elsewhere on the back and/or isolated. If it doesn't work put the OEM back in. Nothing will be damaged as an antenna is purely passive (assuming you don't suck at soldering).

I would also advise against upping supply voltage in the FOB... Most ICs are not 3.3V AND 5V tolerant and you'd be risking finding one which wasn't behind voltage regulation. Also, if the FOB still functioned, all you'd likely have done is increase heat as the LDOs/switching regulators will have to work harder with the bigger drop.

 

https://www.youtube.com/watch?v=3Wmr1VPU8cw

 

Funny, this was just posted on Reddit the other day. Thieves stealing car by extending the signal of the keyfob inside the house and using a laptop/program to override it

https://www.reddit.com/r/Damnthatsi...20k_bmw_x6_m_stolen_within_30_seconds_with_a/

 

You have to touch buttons but that re-enables the proximity unlock. Its almost better just to get an RFID blocker bag and store your keys in it when not in use.

 

Same for me. Left the FOB on passenger seat for 6 minutes, truck started just fine.